PaperCut NG/MF Unsafe Reflection Vulnerability (CVE-2026-82078) Analysis

A critical flaw in PaperCut NG and PaperCut MF allows authenticated attackers to execute arbitrary Java bytecode under the security context of the underlying PaperCut server process. Tracked as CVE-2026-82078, the PaperCut NG/MF unsafe reflection vulnerability carries a CVSS score of 9.1 and stems from unsafe reflection processing during configuration parameter modification. While exploiting the flaw directly requires high administrative privileges, threat actors can pair it with initial access flaws—specifically CVE-2026-81578—to achieve full remote code execution on vulnerable print management infrastructure without prior administrative standing.

Technical Breakdown and Exploitation Mechanics

The root cause of CVE-2026-82078 lies in improper input handling within PaperCut’s server application where user-controlled input dictates class instantiation or method invocation (CWE-470). By manipulating specific system configuration parameters, an attacker can leverage reflection mechanisms in the Java application server to instantiate arbitrary classes already residing on the application classpath.

Because the vulnerability allows arbitrary execution of existing Java bytecode within the server context, an attacker can invoke administrative routines, tamper with file management subsystems, or execute system commands under the operational context of the PaperCut server. In standard enterprise deployments, PaperCut runs under high-privilege service accounts (NT AUTHORITY\SYSTEM on Windows or root on Linux) to manage local print queues and directory services. Consequently, arbitrary code execution via reflection grants full administrative control over the host system.

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) highlights several critical operational characteristics:

• Scope Changed (S:C): Code execution within the Java runtime breaks out of the application container’s security boundary, allowing complete compromise of the hosting operating system and adjacent network components.
• Low Attack Complexity (AC:L): The attack vector is straightforward once administrative parameter access is achieved, requiring no user interaction (UI:N).

The Chaining Threat and Exploitation Risk

On its own, CVE-2026-82078 requires high-privilege access (PR:H), which might lead security teams to downgrade its immediate priority. However, public exploit payloads and integration into framework tooling—including active Metasploit pull requests—demonstrate that this flaw is designed to be chained with CVE-2026-81578, an authentication bypass or privilege escalation vulnerability affecting the same server architecture.

When chained, an unauthenticated network attacker can bypass access controls via CVE-2026-81578 to elevate rights, then immediately trigger CVE-2026-82078 to achieve full unauthenticated remote code execution. This multi-stage attack pattern mirrors previous campaigns against centralized print management systems, where attackers targeted perimeter-exposed or internally reachable print servers to gain lateral movement footholds, harvest active directory credentials, or establish persistence.

While the calculated EPSS score currently sits at 0.46% (38.3rd percentile), this statistical baseline understates the operational risk in environments where PaperCut administration web interfaces are exposed to broad internal subnets or the public internet.

Affected Versions and Target Environment Exposure

PaperCut NG and PaperCut MF instances across major release branches are vulnerable:

• 24.x releases: Versions prior to 24.1.9
• 25.x releases: Versions 25.0.2 through 25.0.11 (fixed in 25.0.12)
• 26.x releases: Versions 26.0.2 through 26.0.3 (fixed in 26.0.4)

Print management servers in higher education, healthcare, legal, and government sectors are disproportionately exposed due to centralized multi-tenant deployment models and frequent integration with enterprise single sign-on (SSO) and Active Directory.

Required Actions and Remediation

Organizations running affected versions of PaperCut NG or PaperCut MF should apply official vendor updates immediately to patch both CVE-2026-82078 and its accompanying chaining vector CVE-2026-81578.

1. Upgrade Target Deployments:

   • Upgrade 24.x branches to PaperCut NG/MF 24.1.9 or later.
   • Upgrade 25.x branches to PaperCut NG/MF 25.0.12 or later.
   • Upgrade 26.x branches to PaperCut NG/MF 26.0.4 or later.

2. Network Isolation and Access Control:

   • Restrict access to the PaperCut administrative interface (default ports 9191/9192) to dedicated management VLANs or restricted jump boxes. Administrative interfaces must never be exposed directly to the public internet.

3. Federal Compliance Deadlines:

   • Federal agencies and organizations aligning with CISA Directive BOD 26-04 must complete patching and execute forensic triage requirements no later than September 14, 2026. If updates cannot be applied prior to the deadline, the service must be disconnected from the network.